Gomagnet - 详情 - Applied Network Defense | YARA For Security Analysts [FCO]

Detecting malicious elements within files is a core security skill for incident responders, SOC analysts, threat intelligence analysts, malware analysts, and detection engineers alike. There are different ways to accomplish that goal, but none are more flexible or widely used as YARA.

YARA is a pattern-matching tool used to help identify and classify malware in a variety of scenarios. By writing YARA rules, security practitioners can detect whether malware exists within a group of files, triage a potentially compromised host, or identify common elements between samples to bolster threat intelligence.

The YARA syntax provides a simple and powerful framework for expressing detection logic for file content. Using the YARA executable, you can search for matches based on the rules you write across a single folder or entire system. When you write detection rules for YARA, you can apply those rules in a variety of scenarios and share the rules with your peers in the detection and threat intel communities.

“Most security practitioners should be familiar with the holy trinity of detection. That’s Suricata for network traffic, Sigma for logs, and YARA for files.”

YARA is the open-source standard for detecting malicious file-based content, but there has never been a course that takes a foundational approach to learning detection engineering through the lens of YARA…. until now.

I’m excited to offer an online course that will teach you how to interpret, build, and tune YARA rules to become a better detection engineer or analyst.

Introducing…

YARA for Security Analysts will teach you how to write, tune, and leverage YARA rules to aid security investigations and research. This course requires no prior YARA experience and will take you from beginner rule writing through advanced techniques.

You'll learn...

YARA Fundamentals

• The anatomy of YARA rules • Rule composition and sequencing • Rule testing at the command line and with CyberChef

YARA Rule Syntax

• String matching basics • Matching hexadecimal values • Complex matches with regular expressions • Controlling matches with rule conditions • Using modules to extend YARA functionality

Detection Research Methodology

• The detection research process from the ground up • How to build and manage a malware corpus • Common file formats and how to approach them • Bulk rule testing against malware corpora • Detection based on exported functions and code-signing certificates

Ruleset Management

• Building global vs. private rules • Tuning false positives • Resources for performance measurement and tuning

Adversary Tradecraft

• Common “generic” detection ideas for hunting • Identifying malware masquerades • Finding high entropy content • Identifying the use of linked libraries • How attackers leverage stack strings • Detecting obfuscated strings

Extended Topics

• Content ordering and proximity • Writing rules for features that modules don’t identify • Bulk rule creation with CyberChef and text editors • Accelerating rule writing with scripts • Using external variables

You’ll start by learning the common use cases for YARA and the basic structure of its rules. We’ll walk through several examples where I show you how to write simple rules for real malware, and you’ll get some practice interpreting and fixing pre-written rules. As we progress, you’ll work through labs where you’ll write your own rules based on malware samples that I provide. In most cases, I’ll provide a video walkthrough demonstrating how I approached writing the lab rules, but you should save those for after you’ve made your own attempt.

You’ll quickly become comfortable writing YARA rules in the scenarios where they will be most useful for you. I’ll be with you the entire way to provide feedback on your work and push you forward.

If you want to learn how to write efficient and effective YARA rules for detection, response, or threat intelligence… YARA for Security Analysts is the course you’re looking for.

YARA for Security Analysts Includes:

Over 20 hours of demonstration videos. These videos will break down the concepts and skills you need to become adept at writing YARA rules to detect diverse malware characteristics.

Hands-on labs to help you develop and test your skills. You’ll complete lab exercises by following along with class demonstrations and analyzing real malware to write your own YARA rules. I’ll be with you along the way to provide guidance and feedback on your work.

Participation in our student charitable profit-sharing program. A few times a year we designate a portion of our proceeds for charitable causes. AND students get to take part in nominating charities that are important to them to receive these donations.

Meet the Course Author – Steve Miller:

Steve Miller is a threat intelligence analyst and researcher of adversary tradecraft, obsessed with finding human fingerprints in digital artifacts. Rather than the What and Why of a breach, he focuses on the Who and the How -- the attribution and modi operandi of cyber threat actors. Steve recently joined Microsoft after eight years at Mandiant working at the intersection of detection, incident response, and threat tracking. Prior to joining Mandiant, Steve did research and special projects for federal government agencies such as the U.S. Department of Homeland Security and the U.S. Department of State...

Full Course, Including Course Material By OP

Media Information:

Course Source: https://www.networkdefense.co/courses/yara/

Gomagnet 2023.

使用 WebTorrent 边下边播。

数据来自Pirate Bay。